GitHub's new package firewall blocks malicious npm installs before they run
GitHub package firewall
GitHub has launched a package firewall in public preview for Enterprise Cloud customers, aimed at stopping malware that strikes at install time and steals credentials on CI/CD hosts and developer machines. Sitting between endpoints like Actions runners and coding agents and upstream registries, it inspects metadata requests and downloads against admin-set policies — cooldown periods, GitHub Advisory Database malware and vulnerability alerts, and supply-chain checks like attestation downgrades. It's free during preview, supports only npm for now, and will be metered at general availability.
An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code.